any idea how I would find out what the 3rd party is and stop it?
You could try running EtreCheck and look at what LaunchAgents and LaunchDaemons are installed. Also look at the installation section towards the end. Or, you can use the Share Report button to copy the report and paste into the Additional Text area (document icon in reply toolbar).
EtreCheck is free to use for this function. He does sell an upgrade version that is not needed to figure this out.
I don't use it, but I have seen where DropBox will hijack the screenshots. Maybe it has some new functionality. Or, since it is docx, perhaps OneDrive.
For a Folder Action as etresoft described, try searching Spotlight for Folder Action Setup.
That will list any Folder Actions enabled and if you select one, it will show what script it is running.